1. Field of the Invention
The present invention relates to an electronic control apparatus including a plurality of microcomputers, in particular relates to an electronic control apparatus having a function of on-board rewriting the control software of each microcomputer thereof.
2. Description of Related Art
There is known a vehicle-use electronic control apparatus that includes a non-volatile memory such as an EEPROM or flash memory which is electrically rewritable (may be referred to as a rewritable non-volatile memory hereinafter), and is so configured that the control software including control programs and control data stored in the rewritable non-volatile memory thereof can be rewritten even after shipment from the factory.
In such type of the electronic control apparatus, the microcomputer, which operates to control a control object such as a vehicle engine in a normal mode by executing control software stored in a non-volatile memory, shifts from the normal mode to a rewrite mode in which rewrite processing software is executed instead of the control software, if a mode switch command is received from a rewriting device communicatably connected to this electronic control apparatus in order to perform a rewriting process by which the control software in the rewritable non-volatile software is rewritten to different control software transmitted from the rewriting device.
According to such type of the electronic control apparatus, since it is possible to rewrite the control software stored in the rewritable non-volatile memory in a state that the microcomputer is mounted on the electronic control apparatus, that is, since it is possible to perform the onboard-rewriting of the control software, it becomes possible to easily address the situation in which the contents of the operation (the contents of the control) of this electronic control apparatus has to be changed for some reason after it is shipped from the factory.
Recently, there is a trend that such type of the electronic control apparatus includes two or more microcomputers due to the control process becoming complicated. Accordingly, it has been proposed to configure the electronic control apparatus of the type including two or more microcomputers such that the on-board rewriting is possible for each of the microcomputers. For example, refer to Japanese Patents No. 3097580 or No. 3137012.
Some of the electronic control apparatuses of the type including two or more microcomputers are provided with a monitor function that a particular microcomputer monitors the other microcomputer. The particular microcomputer monitors whether the other microcomputer is normally executing the control software in the normal mode, and upon detecting any abnormality, resets the other microcomputer. For more details, refer to the above mentioned patent documents.
The electronic control apparatus of the type including a plurality of microcomputers and being capable of performing the on-board rewriting the control software for each of the microcomputers may be so configured that, when the control software needs to be rewritten, all the microcomputers are caused to shift to the rewrite mode at once, rather than to shift to the rewrite mode successively one by one, by a mode switch command transmitted from the rewriting device, and subsequently the control software is rewritten in succession for each of the microcomputers in this state. That is because, in the case where a plurality of the microcomputers operate sharing the same data, during the period when the control software of one of the microcomputers is being rewritten, it cannot be ensured that the control is performed as desired by the other microcomputers operating in the normal mode.
This configuration is needed particularly in the case where a particular microcomputer Ma is provided with the monitor function of monitoring the other microcomputer Mb. Because, since if the rewriting operation of the control software is performed for the microcomputer Mb in a state in which the microcomputer Ma having the monitor function is kept to be in the normal mode, the microcomputer Ma inevitably resets the microcomputer Mb by the monitor function, it is necessary to cause both the microcomputers Ma, Mb to exit from the normal mode to disable the monitor function of the microcomputer Ma.
However, if the configuration in which all the microcomputers are shifted to the rewrite mode at once is employed in the electronic control apparatus satisfying the following conditions (1) and (2), the rewriting of the control software may not be performed normally.
(1) The electronic control apparatus includes at least two microcomputers A, B, and when the rewriting of the control software is necessary for each of the microcomputers A, B, the rewriting operation is performed on the microcomputer B first.
(2) Of the microcomputers A, B, at least the microcomputer A is always supplied with electric power. The reason for that is explained below.
In the electronic control apparatus as shown in the above mentioned patent documents where each of the microcomputers is configured to be supplied with electric power and to start operation when the ignition switch of a vehicle is turned on, if any one of the microcomputers erroneously has shifted from the normal mode to the rewrite mode, it can be returned to the normal mode by turning off the ignition switch and then turn on the ignition switch again.
On the other hand, in the electronic control apparatus satisfying the above conditions (1), (2), since the microcomputer always supplied with electric power cannot return to the normal mode by turning off and then on the ignition switch, a time-out function is provided at least in the microcomputer A, as a fail-safe measure in case the microcomputer erroneously shifts to the rewrite mode. This time-out function, which is implemented by executing rewrite processing software in the rewrite mode, is a function that the microcomputer is returned to the normal mode if it is detected that information necessary to perform the rewriting (a predetermined command, data constituting control software to be newly written, etc.) has not been transmitted from the rewriting device within a certain time period.
However, the electronic control apparatus satisfying the conditions (1), (2) and provided with the time-out function has the following problem.
When the microcomputers A, B are shifted to the rewrite mode at the same time to perform the rewriting of the control software for the microcomputers A, B in succession, if the rewriting is started for the microcomputer B first, the microcomputer A returns to the normal mode by the action of the time-out function, and accordingly the control software of the microcomputer A cannot be rewritten, because the information necessary to perform the rewriting of the control software is not transmitted from the rewriting device to the microcomputer A during the period in which the control software of the microcomputer B is being rewritten.
In addition, if the microcomputer A is configured to monitor the microcomputer B in the normal mode, the microcomputer A which has returned to the normal mode by the action of the time-out function resets the microcomputer B which is performing the rewriting of the control software. Accordingly, also the control software of the microcomputer B cannot be normally rewritten.